At a glance
- Row-levelGranularity
- ScheduledEntitlement sync
- Public sectorDomain
- TableauPlatform
The problem
Reporting for a public administration carries security requirements that are not negotiable: a user sees the data they are responsible for and nothing else. Geography was the usual boundary, with a team accountable for certain regions seeing only those.
The organisation already knew who everyone was. An identity store held the users, their groups, and which applications each group could reach. What did not exist was the link to the analytics: nothing said which rows a group was entitled to. Filling that gap by hand, per workbook, would have been laborious and impossible to trust.
The architecture
How an entitlement resolves
From an account in the identity store to the rows a person is allowed to see. The shaded columns are the part I designed and built.
Names are simplified placeholders.
What I designed
The surrounding platform was a team effort: a scheduled script on a virtual machine pulled accounts into the identity store, and the server's own projects and groups were read back out to keep both sides in step.
My part was the layer that turns identity into data access. Two mappings do the work: one binds each user group to the dimension values it may see, the other binds each application to the folder its content lives in. Both resolve inside the data models I had built, so group membership decides a user's rows without any workbook implementing a rule.
How it resolves
| User group | Rows it may see |
|---|---|
| Group A | Region 1 |
| Group B | Region 1, Region 2 |
| Group C | All regions |
Illustrative values. A user inherits their group's entitlement and the model returns only matching rows, so the same workbook shows different data to different people.
Design decisions
Access follows group membership, not a spreadsheet
The identity store already knew who belonged to which group, and which groups could reach which applications. The entitlement matrix binds onto that rather than restating it, so adding someone to a group is the whole of granting them access.
One join, enforced in the model
Entitlements resolve inside the data model, not in each workbook. An author cannot forget to apply the filter, because there is no unfiltered version of the data to reach for.
The matrix is the design work
Mapping groups to permitted values sounds mechanical until the dimensions come from models built for analysis, not for permissions. Making the two agree, with no gaps and no overlaps that quietly widen access, was the substance of it.
Kept current without upkeep
A scheduled job keeps accounts current, so entitlements reflect the organisation rather than the day the system was set up. Permission models fail slowly: correct at launch, wrong six months later.